> How do we know this is safe from bad actors?
You don't. You never will. This is the case not just for Mozilla but for all VPN services.
Until there's some kind of hardware-level attestation that verifies a server is running a particular software installation, that's going to remain the case.
> VPN's are the only way of protecting what should be protected speech.
No, if you want safety, a VPN is not the solution. VPN providers have invested a lot of marketing in trying to tell you otherwise but it's simply not true.
All a VPN does is move what little trust you're forced to have in your ISP to a different, often less-regulated ISP.
The solution if you want privacy and/or anonymity is a technology built for that purpose, like Tor or I2P.